Phishing attacks with new domains likely to continue

Unfortunately the string of phishing attacks using domain-confusionand legitimate-looking emails continues. This is the same attack PyPI saw a few months agoand targeting many other open source repositoriesbut with a different domain name. Judging from this, we believe this type of campaign will continuewith new domains in the future.

In short, there’s a new phishing campaigntargeting PyPI users occurring right now. The email asks you to “verify their email address”for “account maintenance and security procedures” with a note that your account may be suspended.This email is fake, and the link goes to pypi-mirror.org

which is a domain not owned by PyPI or the PSF.

If you have already clicked on the link and provided your credentials, we recommend changing yourpassword on PyPI immediately. Inspect your account’s Security History for anything unexpected.Report suspicious activity, such as potential phishing campaigns against PyPI, to security@pypi.org.

What is PyPI doing to protect users?

There’s no quick-and-easy method for PyPI maintainers to completelyhalt this sort of attack short of requiring phishing-resistant 2FA (such as hardware tokens).Below are the following steps we’re taking to keep users safe:

• Contacting the registrars and CDN of the malicious domains to have them taken down.
• Submitting phishing domains to lists of known-malicious URLs. This makes browsers show a warning before visiting the website, hopefully triggering alarm bells for users.
• Collaborating with other open source package managers to share strategies for quicker domain take-downs.
• Exploring methods to make authenticating using TOTP-based 2FA more resistant to phishing.

What can you do as a maintainer?

If you are a maintainer of a package on PyPI, you can help protect your users by adopting the following practices:

• Don’t trust or click on links in emails that you didn’t trigger yourself.
• Use a password manager that auto-fills based on domain name and exclusively using this feature. If auto-fill isn’t working when it usually does, that is a warning sign!
• Adopt a phishing-resistant 2FA method such as hardware keys.
• When in doubt, ask for help before taking action. There is no shame in being cautious, share fishy-looking emails with others.
• Share this warning within your own communities. PyPI is not the first or last open source service that will be targeted with phishing attacks.